PT-2025-34899 · Coolify · Coolify

Mike G.A · Publicado 2025-08-27 · Atualizado 2025-08-28 · CVE-2025-34157

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions: Coolify versions prior to v4.0.0-beta.420.6

Description: Coolify is susceptible to a stored cross-site scripting (XSS) attack within the project creation workflow. An authenticated user possessing low privileges can create a project utilizing a maliciously crafted name that incorporates embedded JavaScript. When an administrator attempts to delete the project or its associated resource, the payload is executed within the administrator’s browser context, potentially leading to a full compromise of the Coolify instance. This compromise may include the theft of API tokens, session cookies, and access to WebSocket-based terminal sessions on managed servers.

Recommendations: Update to Coolify version 4.0.0-beta.420.6 or later.

Exploit

Correção

XSS

RCE

Enumeração de Fraquezas

CWE-79

CWE-20

Identificadores relacionados

CVE-2025-34157

Produtos afetados

Coolify

Referências · 7

• 🔥 https://github.com/Eyodav/CVE-2025-34157 · Exploit
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.420.7 · Correção, Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-34157 · Nota de Segurança
• https://twitter.com/CVEnew/status/1960751083606958512 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1960855053192868070 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-34157 · Aviso do Fabricante
• https://coolify.io · Nota